Match each observed network or wireless technical indicator on the left to its corresponding attack classification on the right.
- Network telemetry exhibiting a high volume of TCP SYN frames originating from a single IP targeting sequential destination ports, accompanied by immediate TCP RST/ACK responses.Port Scanning
- Capture log exhibiting a flood of unauthenticated 802.11 management frames containing Reason Code 7 sent to client workstations using the MAC address of a legitimate access point.Deauthentication Attack
- DHCP server logs demonstrating rapid exhaustion of the available IP scope caused by thousands of distinct MAC addresses generated continuously from a single physical switch port.DHCP Starvation
- Wireless site survey logs revealing an unauthorized access point broadcasting the corporate SSID with a stronger RSSI but configured with mismatched security authentication requirements.Evil Twin
Answer
Port Scanning matches TCP SYN probes across sequential ports. Deauthentication Attack matches 802.11 management frame floods with reason codes. DHCP Starvation matches rapid IP scope exhaustion via MAC address spoofing. Evil Twin matches unauthorized access points spoofing corporate SSIDs with mismatched security settings.
Each attack type exhibits unique packet and log signatures: Port scanning shows systematic connection probes across port ranges; Deauthentication attacks exploit unauthenticated 802.11 management frames; DHCP starvation exhausts IP scopes using spoofed MACs; Evil Twin attacks mimic legitimate wireless SSIDs.
Step-by-Step Solution
Key Concept
Network and Wireless Attack Indicators